EUVD-2026-81265

A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream Noelware/docker-manifest-action used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive...

PT-2026-99527

TuxCare rebuilt drupal/form builder to address 1 CVE. Fixed in 7.1.22-p1+tuxcare...

PT-2026-94191

Name of the Vulnerable Software and Affected Versions flatpak-builder affected versions not specified Description A flaw exists where Git hooks are not disabled when applying patch sources with use-git-am set to true. An attacker providing a malicious source containing a Git post-applypatch hook...

CVE-2026-86320: Improper Control of Generation of Code

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary...

CVE-2026-86320: Improper Control of Generation of Code

A flaw was found in flatpak-builder where Git hooks are not disabled when applying patch sources with use-git-am: true. An attacker who can provide a malicious source containing a Git post-applypatch hook can cause the hook to execute on the host during the build process, resulting in arbitrary...

image-builder security update

72.0.0-1.0.3 - Rebuild for CVE-2026-25681, CVE-2026-27136, CVE-2026-41178, CVE-2026-42502...

image-builder security update

72.0.0-1.0.3 - Rebuild for CVE-2026-25681, CVE-2026-27136, CVE-2026-41178, CVE-2026-42502...

PT-2026-95179

Name of the Vulnerable Software and Affected Versions Brizy – Page Builder versions prior to 2.8.15 Description Stored Cross-Site Scripting occurs due to insufficient input sanitization and output escaping. Authenticated attackers with Contributor-level access or higher can inject arbitrary web...

PT-2026-94180

Name of the Vulnerable Software and Affected Versions Master Addons for Elementor versions prior to 3.1.9 Description The plugin fails to perform an authorization check on the AJAX action used to deactivate Popup Builder popups. It relies solely on a nonce a number used once to prevent replay...

CVE-2026-91015: Missing Authorization

The Master Addons for Elementor WordPress plugin before 3.1.9 does not perform an authorization check on the AJAX action that deactivates its Popup Builder popups, relying only on a nonce that is publicly output to every visitor, allowing unauthenticated attackers to permanently disable any popup...

CVE-2026-85469

A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream Noelware/docker-manifest-action used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive...

CVE-2026-85469

A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream "Noelware/docker-manifest-action" used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive...

CVE-2026-85469

quay-builder-qemu contains a flaw in its release workflow, where the third-party GitHub Action Noelware/docker-manifest-action is pinned to a mutable @master branch . Because the reference is not fixed to a specific commit, a remote attacker who compromises the upstream action repository can inje...

CVE-2026-85469 Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to mutable @master with registry credentials in scope

A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream Noelware/docker-manifest-action used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive...

CVE-2026-85469 Quay-builder-qemu: quay-builder-qemu: release workflow uses third-party action pinned to mutable @master with registry credentials in scope

A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream Noelware/docker-manifest-action used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive...

CVE-2026-85469

A flaw was found in quay-builder-qemu. A remote attacker could exploit this by compromising the upstream Noelware/docker-manifest-action used in the release workflow, which is pinned to a mutable branch. This allows the attacker to inject arbitrary code, leading to the exfiltration of sensitive...

Arbitrary Code Injection

Overview org.jenkins-ci.plugins:script-security is a package that allows Jenkins administrators to control what in-process scripts can be run by less-privileged users. Affected versions of this package are vulnerable to Arbitrary Code Injection in the handling of @Builder annotations when the...

CVE-2026-92126

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to execute code outside the sandbox if a suitable...

EUVD-2026-80750

Jenkins Script Security Plugin 1415.v9af9b3ac253d and earlier does not reject @Builder annotations whose builderStrategy member names an arbitrary class, allowing attackers with permission to define and run sandboxed scripts, including Pipelines, to execute code outside the sandbox if a suitable...

CVE-2026-92126

The Jenkins Script Security Plugin (version 1415.v9a_f9b_3a_c253d and earlier) contains a sandbox bypass vulnerability. The plugin fails to reject @Builder annotations where the builderStrategy member refers to an arbitrary class. This allows an attacker with permission to define and run sandboxe...